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6. (Amended) A method of tracing a receipt of data from a computer 
network comprising: detecting a transport-layer request to transmit a packet for an 
input/output connection to a port; searching the packet to determine an identity of a 
process that created the packet; and in response to the detection of a receipt of data at the 
port, storing in a trace log an entry representing the receipt of the data, wherein the entry 
comprises the process identification, and wherein the trace log is accessible to determine 
a volume of the data being transmitted over the network. ^^^^ 

10. (Amended) A facility for tracing data traffic on a network, the facility 
comprising: an identifying means for identifying a process causing a transport-layer 
request to transmit data via the network; and a logging means in communication with the 
identifying means for logging arid] event, wherein the event comprises the identification 
the process and wherein the logging means is useable to determine a volume of data 
traveling over the network. 



15. (Amended) A computer-readable medium having stored thereon 
computer-executable instructions for performing steps comprising: detecting a transport- 
layer request to transmit an input/output packet; searching the input/output packet to 
determine an identity of a process that created the input/output packet; and storing in a 
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trace log an entry representing the request, wherein the entry comprises the identity of the 
Y process, and wherein the trace log is accessible to determine a volume of data being 
transmitted over the network. 



1 8. (Amended) A computer-readable medium having stored thereon 
computer-executable instructions for performing the steps comprising: detecting a 
transport-layer request to transmit a packet for an input-output connection to a port; 
searching the packet to determine an identity of a process that created the packet; and in 
response to the detection of a receipt of data at the port, storing in a trace log an entry 
representing the receipt of the data, wherein the entry comprises the process 
identification, and wherein the trace log is accessible to determine the volume of the data 
being transmitted over the network. 



22. (New) The method of claim 1, wherein the transmission of data is recorded 
at the completion of the transmission indicated by an acknowledgement from the first 
device. 

23. (New) The method of claim 1, wherein the receipt of data is recorded at the 
receipt of a first block of data and a last block of data. 
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24. (New) The method of claim 4, wherein the identity of the process includes a 
port number or an IP address relating to the transmission. 
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